self-host your photo library with Immich

your photo library is a surveillance diary and you handed the keys to someone else

every photo your phone takes comes with gps coordinates, a timestamp, device info, sometimes even your home wifi network name buried in the exif data. google photos is genuinely good software. it's also a permanent record of everywhere you've been, synced to servers you don't control, scanned by algorithms you can't audit, subject to a terms of service that can change whenever they feel like it. immich gives you the same experience, auto backup, face grouping, search, mobile app, timeline, without any of that leaving your house.

what immich actually is

immich is an open source, self-hosted photo and video backup solution. think of it as "google photos but it's a docker container in your closet." it runs as a stack of services, a postgres database, a machine learning service for face and object detection, redis for caching, and the main server, all orchestrated together with docker compose. you point your phone's immich app at your server's address and it auto uploads new photos the same way google photos would, except the only company with access to your data is whichever company made your hardware, and that company is you.

getting it running

the official setup starts with grabbing their example compose file, which defines every service immich needs:

wget -O docker-compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env

the .env file is where you set your upload location, database password, and timezone. open it before you do anything else and change the default postgres password. a lot of self-hosted breaches start with someone copy-pasting a tutorial's default credentials into production and never looking back.

then the actual launch:

docker compose up -d

breaking that down: docker compose reads your compose file and stands up every service it defines as its own container. up starts them. -d means detached, so it runs in the background instead of locking up your terminal. behind the scenes this is pulling images for the server, the ml service, redis, and postgres, then wiring them together on an internal network so they can talk to each other without being exposed to the outside world unless you say so.

once it's up, you hit your server's ip on the configured port to create your admin account, then install the immich mobile app and point it at that same address. first sync will take a while depending on how many years of photos you're dumping on it. after that it just runs quietly, backing up new shots the moment you take them.

lock down access before you expose anything

the single biggest mistake people make with self-hosted services is forwarding a port straight to the internet so they can access photos from their phone while out and about. don't do that by default. instead:

use a vpn like wireguard or tailscale so your phone only talks to immich when it's authenticated into your own private network. if you genuinely need external access without a vpn, put a reverse proxy like caddy or nginx in front of it with tls and consider adding an auth layer like authelia or a login-protected gateway. check your router too, plenty of people get "hacked" because upnp silently opened a port they never intended to expose.

the backup is the part everyone skips

self-hosting your photos solves the privacy problem but it creates a new risk: now there's exactly one copy, and it's sitting on a single drive in your house. that drive will fail eventually, every drive does. "self-hosted" is not a backup strategy, it's a storage decision.

take snapshots of your immich library and database regularly, and get at least one copy offsite. restic is a solid tool for this:

restic backup /path/to/immich/library --repo s3:your-bucket-or-remote

encrypt it before it leaves your network, restic does this by default, and keep the repo password somewhere that isn't also stored on the same machine you're backing up. test a restore occasionally too. a backup you've never restored from is a theory, not a backup.

the takeaway

self-hosting immich isn't about distrust for its own sake, it's about reducing the number of parties who can see where you've been and who you were with when you took a photo. the tradeoff is you now own the uptime, the patching, and the backups. that's a fair trade if you actually do the second half. spin it up, lock it behind a vpn, and set up offsite backups before you delete anything from your old photo service. send this to whoever in your family is the unofficial designated photographer, their camera roll has more metadata than they think.